CVE-2025-59160 - CVE House

Back to Database

Status published Low CVE-2025-59160

matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

2.7 CVSS

Vulnerability Description

Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59160

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from matrix-org

View All →

matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values

matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method

Matrix Rust SDK allows SQL injection in the EventCache implementation

matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim

Affected Vendor

matrix-org

View all reports →

Affected Software

matrix-js-sdk

Vulnerable Versions:

< 38.2.0

Timeline

Official Publish: September 16th, 2025

Last Modified: September 16th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle

Credential Access

T1071 Application Layer Protocol

Command and Control

T1552 Unsecured Credentials

Credential Access

T1190 Exploit Public-Facing Application

T1041 Exfiltration Over C2 Channel